With Internet use forming an ever greater part of day to day life, security exploits that steal or destroy system resources, data, and private information are an increasing problem. Governments and businesses devote significant resources to preventing intrusions and thefts related to these security exploits. Security exploits come in many forms, such as computer viruses, worms, trojan horses, spyware, keystroke loggers, adware, and rootkits. These exploits are delivered in or through a number of mechanisms, such as spearfish emails, clickable links, documents, executables, or archives. Some of the threats posed by security exploits are of such significance that they are described as cyber terrorism or industrial espionage.
Many security exploits attack vulnerabilities of the operating system kernel. Once those exploits have established themselves in the kernel, the exploits use any of a number of mechanisms to create user-mode processes or threads. The user-mode processes or threads allow the exploits to act in user-mode, which provides greater freedom of action to the exploits. These mechanisms have their difficulties, however. For example, an exploit may include a dynamic-link library (DLL) and try to coerce or trick a user-mode process into loading the DLL. This requires substantial programming effort, though, as the exploit is unable to rely on the operating system's loader. In another example, an exploit may write a DLL to disk and cause a user-mode process to load the DLL, but such writes to disk may be detected by security software.